3

In my experience Authcache gives a great enhancement to performance, however I am wondering what are the potential vulnerabilities using authcache and boost together? My worry is that when the administrator does not exclude user specific paths in boost configs, a saavy user can somehow access to other users' cookies and do nasty things.

I guess it is not just a hypothesis, as I've seen that at least in one occasion in a boost+authcache+varnish arrangement a user reported that others have sent message on her part without her knowledge. If this indicate a real security hole, how should one counter int? Which paths should be absolutely excluded from being cached by boost?

What other potential security holes can be in this setting and how to avoid them?

Improve this question
2
  • 2
    related to drupal.org/node/1565496 and drupal.org/node/966152#comment-5526066
    – LLub
    Commented May 7, 2012 at 20:34
  • 1
    from the second link above:"authcache is currently only suitable if you want to speed up sites with roles used for "personalising" the content. Authcache currently only provides very "casual" protection to private information so if you want to keep certain content totally protected you will need to wait for a subsequent release of this module. " This may need to be emphasised in the module page: Using Authcache is inviting catastrophe for a community site!
    – alfish
    Commented May 7, 2012 at 21:51

1 Answer 1

Reset to default
1

Long term I would take a look at ESI over authcache. Not sure when manarth will get a stable release of 7.x out. ESI has fairly strong security with rotating keys and things like that.

Improve this answer
4
  • Do you mean that ESI is an Authcache substitute that eliminate the risk of the authcached pages/cookies being hijacked?
    – alfish
    Commented May 19, 2012 at 6:53
  • 1
    It's has the same risk of your session cookie being hijacked. The rotating keys means that X amount of time later a hijacked cookie is no longer valid. It's not a good as being able to log out of your session but it's a pretty good compromise all things considered. This happens on cron: drupalcode.org/project/esi.git/blob/…
    – mikeytown2
    Commented May 19, 2012 at 18:48
  • Actually for some reason my cron does not work (segmentation error that I could not fix). Is the ESI cron independent of the main crop.php?
    – alfish
    Commented May 19, 2012 at 19:29
  • out of the box no, but you can make it independent with minimal effort. I would look into fixing that error. Run each cron hook one at a time till you find the bad hook.
    – mikeytown2
    Commented May 19, 2012 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.